The bare minimum of information required to approve a card payment is only:
- The card number, and…
- The card expiration date.
This means that a card payment may be successful even if other information is missing or incorrect. Some cases where this may occur are:
- An address verification service (AVS) mismatch. This can occur if the address that the customer entered during checkout does not match the address that the card issuer has on file for the card that the customer used.
- A card verification code (CVC) failure. This happens if the customer enters the wrong 3 or 4-digit code usually found on the back of the card they used during checkout.
If a payment is successful despite one or both of those checks failing, it means that the customer’s bank approved the charge despite the invalid or missing information.
You can modify the Radar rules on your Stripe account to stop such payments from being processed, even if they might otherwise have been approved by the bank.
Please see the Stripe documentation for more details about this scenario.